Executive brief
The Securly Chrome Extension, a tool used by schools to filter internet content and monitor student activity, is vulnerable to a denial-of-service attack. Because the extension downloads its configuration over an unencrypted connection, an attacker on the same network (such as a public Wi-Fi) can inject malicious data. This can cause the browser to freeze or crash, effectively preventing the student from accessing any websites.
Technical details
The Securly Chrome Extension (v3.0.7) downloads its 'config.json' file via unencrypted HTTP. An on-path attacker can intercept this traffic and inject malicious regular expression patterns. The extension then compiles these patterns using the 'new RegExp()' constructor without performing complexity validation. By providing a specially crafted pattern designed for 'catastrophic backtracking,' an attacker can cause the JavaScript engine to consume excessive CPU resources, leading to a Denial of Service (DoS) that impacts all browsing activity within the Chrome browser. As of the advisory date, the vendor has not been reached for a patch.
Affected products
- Securly Securly Chrome Extension 3.0.7
Timeline
- 2026-03-30: other: Vendor notified by CERT/CC
- 2026-06-03: disclosed: Public disclosure by CERT/CC and NVD